Merge pull request #22635 from Homebrew/docs-brewfile-tap-trust

Document Brewfile tap trust

docs/Brew-Bundle-and-Brewfile.md

@@ -304,6 +304,12 @@ brew "postgresql@16",
 # Runs `brew install ruby` and, afterwards, writes the installed version to the '.ruby-version` file.
 brew "ruby", version_file: ".ruby-version"
 
+# Trusts the tap, formula or cask so Homebrew loads it when tap trust is required.
+# This works on `tap`, `brew` and `cask` entries.
+tap "user/repo", trusted: true
+brew "user/repo/formula", trusted: true
+cask "user/repo/cask", trusted: true
+
 # Runs `brew install gnupg` or `brew install glibc` only on the specified OS.
 # Note: `brew bundle list` will not output `gnupg` on Linux or `glibc` on macOS` in this case:
 # the Ruby logic means they are "hidden" on other platforms.
@@ -340,6 +346,22 @@ This is useful when a project wants Homebrew to install a runtime and keep a con
 brew "ruby", version_file: ".ruby-version"
 ```
 
+### `trusted`
+
+`tap`, `brew` and `cask` entries support `trusted: true` to declaratively
+[trust](Tap-Trust.md) a non-official tap, formula or cask. Homebrew trusts the
+entry before installing it, so it loads even when tap trust is required.
+
+```ruby
+tap "user/repo", trusted: true
+brew "user/repo/formula", trusted: true
+cask "user/repo/cask", trusted: true
+```
+
+As with `brew trust`, prefer trusting the specific formula or cask you need over
+trusting a whole tap. `brew bundle dump` writes `trusted: true` for entries you
+have already trusted.
+
 ## Versions
 
 Homebrew is a [rolling release](https://en.wikipedia.org/wiki/Rolling_release) package manager so it does not support installing arbitrary older versions of software.

docs/Tap-Trust.md

@@ -68,6 +68,22 @@ tap you administer or rely on heavily, but for one-off installs, automation or
 software from a vendor you do not fully control, prefer trusting only the item
 you need.
 
+## Trusting in a `Brewfile`
+
+You can declare trust in a [`Brewfile`](Brew-Bundle-and-Brewfile.md) with
+`trusted: true` on `tap`, `brew` and `cask` entries:
+
+```ruby
+tap "user/repo", trusted: true
+brew "user/repo/formula", trusted: true
+cask "user/repo/cask", trusted: true
+```
+
+`brew bundle` trusts each entry before installing it, so non-official taps,
+formulae and casks load even when tap trust is required. As on the command line,
+prefer trusting the specific formula or cask you need over the whole tap.
+`brew bundle dump` writes `trusted: true` for entries you have already trusted.
+
 ## Managing trust
 
 List trusted entries: